Don't show NPM badges of projects with `"private": true`

[krzysdz]

Projects that have "private": true set in package.json can't be published to NPM. Currently @pkgjs/statusboard tires to show badges with the version on NPM and install count, which either refer to other projects or don't exist.

For an example of this see the Express StatusBoard and the rows for discussions and expressjs.com, both of which have "private": true [src 1, src 2].